Rolling biometric key exchange

ABSTRACT

Various embodiments are generally directed to techniques of generating a unique biometric key, hashing and salting the key, and storing it. Embodiments include techniques to analyze biological information associated with a user and determine one or more biological characteristics from the analyzed information. The biological characteristics may be used to generate a character string unique to the user, which may be used to generate the biometric key based on a cryptographic algorithm. The hash values, salt values, or the hash function may be changed at a predetermined interval.

BACKGROUND

Biometrics refers to various metrics related to anatomicalcharacteristics or behavioral patterns of humans. Biometric data may bedigital data and may be dependent on, for example, different types ofbiometric identifiers (physiological characteristics), such asfingerprints, palm veins, DNA, hand geometry, etc. Biometric data may bestored on servers or memory devices, which may be accessed and processedby biometric systems.

Typically, biometric data may be stored in an encrypted format tosafeguard it against any manipulation or unauthorized theft ortampering. Although it may be encrypted, biometric data is often, if notalways, stored statically. Thus, unauthorized persons may be able tocopy the biometric data and replay it to access internal accounts orsystems.

Accordingly, there is a need to improve the way biometric data is storedso that it cannot, or at least extremely difficult to, be replayed byunauthorized persons to access internal accounts or systems.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A illustrates a first example biological information in accordancewith one or more embodiments.

FIG. 1B illustrates a first example character string in accordance withone or more embodiments.

FIG. 2A illustrates a second example biological information inaccordance with one or more embodiments.

FIG. 2B illustrates a second example character string in accordance withone or more embodiments.

FIG. 3A illustrates a third example biological information in accordancewith one or more embodiments.

FIG. 3B illustrates a third example character string in accordance withone or more embodiments.

FIG. 4A illustrates a fourth example biological information inaccordance with one or more embodiments.

FIG. 4B illustrates a fourth character string in accordance with one ormore embodiments.

FIG. 5 illustrates an example block diagram in accordance with one ormore embodiments.

FIG. 6 illustrates an example flow diagram in accordance with one ormore embodiments.

FIG. 7 illustrates an example computing architecture of a computingdevice in accordance with one or more embodiments.

FIG. 8 illustrates an example communications architecture in accordancewith one or more embodiments.

DETAILED DESCRIPTION

Various embodiments are generally directed to storing biometric data ina highly secure manner. Biological information and associated biologicalcharacteristics of a user may be analyzed to generate a character stringthat is unique to that user. A cryptographic algorithm may be applied tothe generated character string to further generate a unique biometrickey. The biometric key may then be hashed via a hash function and/or“salted” with additional data related to the user. The hashed and/orsalted biometric key may then be stored in one or more storage devices,where the hash values (or the hash function itself) and the salt valuesmay be changed or “rolled” at a predetermined interval, e.g., time,event, instance, etc.

In embodiments, the biological information to be analyzed may beautomatically accessed or may be provided by the user. It may beunderstood that the term “user” herein is defined broadly and mayinclude any persons, individuals, applicants, clients, etc. Thebiological information may be any information related to variousanatomical or physiological features of the user. In that regard, thebiological information is uniquely associated with the user providingit. For example, it may be an image of the user's face, a scan of theuser's fingerprint, a scan of the user's eye, a scan of the user's hand,hand geometry, a scan of the user's palm and palm veins, and/or arecording of the user's voice. The analysis of the biologicalinformation may involve analyzing different characteristics foundtherein.

According to embodiments, one or more biological characteristics may bederived from the biological information. For example, when thebiological information is a facial image, the biological characteristicsof the face may include at least a distance between the eyes (e.g.,pupillary distance), a face height, a face width, or any distancebetween or distances among an eye, an ear, a nose, an upper lip, a lowerlip, a chin, etc. In another example, when the biological information isan eye scan, the biological characteristics of the eye may include asize of the iris and/or a pupil, a distance between veins of the retina,etc. In yet another example, when the biological information is afingerprint, the biological characteristics may include arches, loops,and/or whorls. In a further example, when the biological information isa voice recording, the biological characteristics of the voice mayinclude one or more unique voice or speech patterns. In yet anotherexample, when the biological information is a palm scan, thecharacteristics may include ridges and lines of the palm, size and/orlength of palm veins, and distances between the veins.

Since the biological characteristics of the associated biologicalinformation is unique to the user, a unique character string (e.g., analphanumeric string) may be generated based on those characteristics.Thereafter, the character string may be applied to, or used as input in,a cryptographic algorithm to generate a biometric key. In embodiments,the biometric key is hashed using a hash function and/or “salted” usingvarious salt data or salt values. It may be understood that “salt” or“salting” relates to adding or hashing additional data, which may beuniquely associated with the user, as input to increase overallcomplexity and security to, for example, defend against dictionaryattacks or pre-computed rainbow table attacks. The hashed and/or saltedbiometric key may then be stored in one or more storage devices, wherethe hash values, hash functions, and/or the salt values and data arechanged or rolled at a predetermined time.

In previous solutions, one problem of storing biometric data in storagedevices is that it is static. The data is thus unchanged, which meansthat an unauthorized person can copy the data and replay the data toaccess secure, internal systems. Another problem of storing biometricdata is that while a user's biological information is typicallyencrypted when stored, the biological information is directly used togenerate root keys (or building other keys with the root keys) foraccessing the internal systems. The above-described embodiments andexamples described herein overcome the above problems and areadvantageous over the previous solutions in numerous ways. For example,the biological information may be used to generate a character stringunique to the user, which is, in turn, applied to a cryptographicalgorithm and used to generate the biometric key. Thus, the biologicalinformation itself and/or the character string are not required to bestored in any storage devices, thereby improving overall security.Moreover, the hash function(s), hash values, and salt values applied tothe biometric key may be constantly changed at different times orintervals, thereby rendering the comprised biometric keys in internalsystems useless at later times.

Reference is now made to the drawings, where like reference numerals areused to refer to like elements throughout. In the following description,for the purpose of explanation, numerous specific details are set forthin order to provide a thorough understanding thereof. It may be evident,however, that the novel embodiments can be practiced without thesespecific details. In other instances, well known structures and devicesare shown in block diagram form to facilitate a description thereof. Theintention is to cover all modification, equivalents, and alternativeswithin the scope of the claims.

FIG. 1A illustrates an example biological information of a user, e.g., afacial image 110. By way of example, image 110 is a close-up, headshotof the user and it may be a digital image captured by at least one inputdevice, such as a camera. In other examples involving other types ofbiological information, the input device may be a fingerprint reader, apalm print scanner or reader, a palm vein scanner or reader, etc. It maybe understood that the image of the user is not limited to a close-upheadshot, but may any suitable image, e.g., profile image, group shot,etc., in which the face of the user is visible and analyzable.

The analysis may be performed on the image 110 by one or more computingdevices or by processing circuitry thereof (the features of which willbe further described below) to determine one or more biologicalcharacteristics of the user. As shown, the user's face may exhibitnumerous biological characteristics. For example, the face has a facewidth 112, a face height, 114, a distance from one pupil of one eye tothe other pupil of the other eye, e.g., pupillary distance (PD) 116, amonocular PD 118, a vertical distance 120 between a pupil and bottom ofthe nose, a vertical distance 122 between a pupil and the lips, and ahorizontal distance 124 between a pupil and an ear.

It may be understood that the face may exhibit many morecharacteristics, such as the distance between ear to ear, the distancebetween one part of the face to an upper lip or lower lip, length ofneck, etc. It may also be understood that different types of picturesmay exhibit different characteristics, for example, a profile image mayreveal eye socket depth and the like. To that end, the biologicalcharacteristics, collectively, may be unique to the user depicted in theimage 110. And based on these characteristics, a character string thatis unique to the user may be generated.

FIG. 1B illustrates an example character string 160 that may begenerated by a computing device or processing circuitry thereof based onthe biological characteristics. As shown, the character string 160 is aseries of alphanumeric characters and may include at least sevendifferent segments 162, 164, 168, 170, 172, 174, where each segment cancorrespond to a biological characteristic of the user. For example,segment 162, which includes characters 789&8*, may represent at leastthe exact numerical measurement of the face width 112 of the user. Forinstance, 789&8* may represent 15.2 centimeters. Different charactersand combinations thereof may be used to represent the measurement indifferent measurement units, e.g., inches, centimeters, etc. Thecharacters in segment 162 may also define more than just a measurementand may define the gender associated with the measurement or the like.The specific characters and the arrangement of those characters insegment 162 may be predefined, predetermined, and/or may be based on acoding technique or system, as will be further discussed below.

As further shown in FIG. 1B, segment 164 includes characters *_ _0 andmay represent at least the measurement of the face height 114 of theuser. Segment 166 is shorter than segment 164 and has characters DBb,which may represent at least the measurement of the monocular PD 118.Segment 168 includes characters uvr89!@ and may represent at least themeasurement of the PD 116. Segment 170 is longest in length and hascharacters _ _655578$, which may represent the vertical distance 122between the left pupil and the lips. As shown, portions of the segment170 may be delimited or defined by spaces, for example, two spacesbetween the underscore and the number 6 and a space between the number 8and the $ symbol. These spaces—the delimitation and use of thesespaces—may represent some informational aspect of the vertical distance122, e.g., measurement unit, gender, color of eye, etc. Similarly, othercharacters, such as the underscore, may be used to delimit or defineparts of the character string. Segment 172 includes characters ty andmay represent at least the vertical distance 120 between the pupil andbottom of the nose. And segment 174 includes characters R& and mayrepresent at least the horizontal distance 124 between the pupil and theear.

It may be understood that the combination of the various segments of thecharacter string may collectively and uniquely define the biologicalcharacteristics of the user. In that regard, the segments may vary inlength, vary in the types of characters used, vary in how spaces and/orcharacters are layered, infused, or delimited, how the segmentsthemselves are arranged, etc.

Selection of the types of characters or symbols in the character string,the arrangement, how they are spaced, etc. may be based on one or morecoding techniques, systems, and/or algorithms. For example, it may bemonoalphabetic ciphers (e.g., caesar, atbash, keyword, pigpen, masonic,Polybius), polyalphabetic ciphers (e.g., vigenere, beaufort, autokey,running key), polygraphic ciphers (e.g., playfair, bifid, trifid,four-square), transposition ciphers (e.g., rail fence, route, columnartransposition), and other suitable types of ciphers, codes, algorithms(e.g., book cipher, beale cipher, morse code, tap code, one-time pad,scytale, semaphore, ASCII, steganography). The coding may be built oncustom-built tables, which may be rolled or changed periodically.Moreover, it may be understood that the coding may integrate or employone (or combinations) of any technique above.

FIG. 2A illustrates another example of biological information of a user,e.g., fingerprint 210, which may be a fingerprint of the user's thumb.The fingerprint 210 may be captured via a fingerprint scanner, ink andpaper, or any suitable way of imaging a fingerprint by a computingdevice. In some instances, the fingerprint 210 may be captured via inkand paper and converted to a digital fingerprint by a camera, a scanningdevice, and the like, for example. The fingerprint 210 may includevarious and numerous loops, whorls, and/or arches unique to the user.

The analysis may be performed on the fingerprint 210 to determine one ormore biological characteristics of the user. As shown in FIG. 2A, forexample, a portion 212 (illustrated by a box) of the fingerprint 210 maybe analyzed. A first level of analysis may include determining how manyloops, whorls, or arches are present in the portion 212. A second levelof analysis may be examining the specific characteristics of the loops,whorls, or arches, or portions thereof, in separate sub-portions 214,216, and 218 of the portion 212. The number of arches and/or distancesbetween each arch in sub-portion 214, for example, may be determined.The same for loops and whorls in sub-portion 214, as well as the numberof arches, loops, or whorls and/or the distances between the same insub-portions 216 and 218 may be determined. Moreover, the unique andspecific patterns and shapes of the loops, whorls, or arches in each ofthe sub-portions may be analyzed and determined. Upon determining andacquiring data associated with the biological characteristics of thefingerprint 210 from the at least first and second analysis, a characterstring that is unique to the user's fingerprint 210 may be generated.

FIG. 2B illustrates another example character string 240 generated by acomputing device based on a fingerprint. As shown, the character string240 may include at least three segments 242, 244, 246, each segmentcorresponding to the analysis performed on a respective sub-portion offingerprint 210. For example, segment 242 may correspond to sub-portion214, segment 244 may correspond to sub-portion 216, and segment 246 maycorrespond to sub-portion 218. Based on the analysis of sub-portion 214,the characters of segment 242 are AbC % I74yR743*, which may indicate,for instance, the types of characteristics found in sub-portion 214(e.g., arches, loops, whorls), the number of those characteristics, thedistance between each characteristic, etc. The characters, the types ofcharacters, and arrangement may be predetermined, predefined, or may bebased on a coding technique system, as described above. As illustrated,the characters of segment 244 are 555et56@@_* and the characters ofsegment 246 are *_yYYRp&&. The characters may also be space or characterdelimited or defined in any suitable way that represents the informationassociated with the biological characteristics. In at least this regard,the generated character string 240 may be unique to the user.

FIG. 3A illustrates yet another example of the biological information ofa user, e.g., eye scan 310. The eye scan 310 may be acquired via an eyescanner, a retinal scanner, or any suitable device capable of scanningor imaging a user's eye. Similar to the above examples, the analysis maybe performed on the eye scan 310 and one or more biologicalcharacteristics unique to the user determined. The eye scan 310 mayinclude biological characteristics, such as an iris size 312, a pupilsize 314, and a distance 316 between two retinal veins. Other veins withvarying distances may also be selected. Based on these characteristics,a character string may be generated, which, again, is unique to theuser.

FIG. 3B illustrates yet another example character string 360 generatedby a computing device based on an eye scan. Character string 360 has atleast three segments 362, 364, and 366. Segment 362 may correspond toinformation regarding iris size 312 and includes charactershyppRrs784++b9. Segment 364 may correspond to information regardingpupil size 314 and includes characters 69652{circumflex over( )}{circumflex over ( )}_ _6&#. And segment 366 may correspond toinformation regarding the distance 316 between the two veins in theretina of the user's eye and includes characters !651333&%_. Thecharacters themselves, the arrangement thereof, and the delimitationand/or use of various spaces and characters may be predetermined,predefined, or based on a coding technique or system, described above.The character string 360 is unique to the user based on the biologicalinformation provided in the user's eye.

FIG. 4A illustrates a further example of biological information of auser, e.g., voice recording 410. The voice may be recorded via amicrophone, for example. The analysis may be performed on the voicerecording to determine one or more unique biological characteristics. Asshown, voice recording 410 may modulate at various levels over thecourse of the recording. Thus, the characteristics that may be derivedfrom the analyzed voice recording 410 includes differing modulationlevels, e.g., highest modulation value, lowest modulation value, andincludes a distance between two adjacent modulations, the overall shapeof the recording, recurring patterns in the modulations, voicefrequency, pronunciations of certain words, enunciation, cadence, etc.

FIG. 4C illustrates a further example character string 460 generated bya computing device based on a voice recording. Using the uniquebiological characteristics determined from the voice recording 410,character string 460 may be generated, which includes characters+7645urTTs&3%_ _45p17rT70909. As set forth above, the characters and thearrangement of those characters may be based on a coding technique orsystem or any other suitable predetermined or predefined technique. Thecharacters and symbols may also be space or symbol delimited or defined.Like the other above described character strings, character string 460is again unique to the user.

FIG. 5 illustrates an example block diagram 500 according toembodiments. Upon generating a character string 502 that is based on thebiological information of the user, e.g., character strings 160, 240,360, 460, the character string may be applied to, or used in, acryptographic algorithm 504 or an encryption algorithm to generate abiometric key unique to the user. In at least that regard, neither thebiological information (including the analyzed and determined biologicalcharacteristics) nor the character string are required to be storedbased on the generation of the biometric key via the cryptographicalgorithm 504. It may be understood that the term biological informationmay be interpreted broadly, as set forth above, and may be anyinformation, a digital image or otherwise, that contains data withrespect to a user's numerous and unique anatomical or physiologicalcharacteristics, which may be encompassed by the term biologicalcharacteristic, as set forth above.

The cryptographic algorithm 504 may be any suitable algorithm forencrypting, concealing, or otherwise scrambling information. Forexample, it may be one (or a combination) of the following: a TripleData Encryption Standard (DES) algorithm, (ii) a RSA public-keyencryption algorithm, (iii) a Blowfish algorithm, (iv) a Twofishalgorithm, (v) an Advanced Encryption Standard (AES) algorithm, (vi) aDiffie-Hellman algorithm, (vii) a Cramer-Shoup algorithm, and (viii) aElGamal encryption algorithm. Additionally or alternatively thecryptographic algorithm 504 may be an equation that is unique, such as(e{circumflex over ( )}2)/(522*e), where “e” represents the characterstring. The result of applying the cryptographic algorithm 504 is abiometric key, which may be any suitable type of encryption key, such asa 512-bit key, a 768-bit key, a 1024-bit key, or a 2048-bit key.

The biometric key may be hashed via a hash function 506 based on varioushash values by a computing device. The hash function 506 and theassociated hash values may be specifically configured for cryptography.As shown in FIG. 5, the hash function 506 outputs a hashed biometrickey. The complexity of the biometric hash may be further increased byadding salt 508, e.g., salt values, to the hashed key, which may be dataassociated with and unique to the user. For example, a salt value may bedata or information related to where the user attended college, names ofthe user's mother and father, what street the user lived when the userwas ten years old, a name of the user's current or past pet, etc. Addingsalt to the biometric hash increases the overall complexity and securityof the biometric data prior to storage. Thus, the output is a hashed andsalted biometric key 510, which can be stored in one or more storagedevices.

Once the hashed and salted biometric key is stored, any of the hashfunction, the hash values, and the salt values may be changed or“rolled” at a predetermined time interval, e.g., every minute, hour, sixhours, 12, hours, 24 hours, week, a triggering event, etc. This ensuresat least that the stored data is not static, thereby rendering thepre-rolled key unusable in accessing internal systems after the rollingprocess.

While the blocks in FIG. 5 are illustrated in a certain order, theprocess of generating the hashed and salted biometric key is not limitedthereto. For example, the hashing and salting may be performedsimultaneously. Alternatively, it may be understood that the salt valuesthemselves can be used as the hash values in the hash function. Inembodiments, the character string may be generated and automaticallyapplied to the cryptographic algorithm simultaneously in real-time.Alternatively, the process of the generating the characters string maybe separate, whereby it is created at a different time than the time ofapplying it to the cryptographic algorithm. For example, one computingdevice may generate the unique character string and a differentcomputing device (connected to the computing device via a network) mayreceive the string to generate the biometric key using the cryptographicalgorithm.

FIG. 6 illustrates a flow diagram 600 in accordance with one or moreembodiments. It may be understood that the features associated with theillustrated blocks may be performed or executed by one or more computingdevices and/or processing circuitry contained therein.

At block 602, biological information may be acquired or received from auser and analysis performed thereon. The biological information may beany information related to the unique anatomical or physiologicalcharacteristics of the user, such as a facial image, fingerprint, eyescan, voice recording, etc., as described above.

At block 604, based on the analysis, one or more biologicalcharacteristics may be determined. For example, a width measurement ofthe user's face, a height measurement of the face, a distance betweenthe pupils of the eyes, a distance between a pupil and the user's lips,etc. At block 606, these unique biological characteristics may be usedto generate a character string indicating such characteristics. Thecharacter string may include numerous alphanumeric characters and/orsymbols can be chosen, applied, and/or arranged in a predetermined way.It may be based on a coding technique or system, as described above.

At block 608, the character string may be applied to or used in acryptographic algorithm to generate a biometric key. At block 610, thebiometric key may be hashed using a hash function and various hashvalues which may be cryptographic in nature and further salted with saltvalues that are unique to the user. The hashed and salted key is thenstored in one or more storage devices.

At block 612, the hash values, hash function, and/or salt values may bechanged at a predetermined time, interval, or when predetermined eventsor instances occur. As set forth above, this ensures that the hashed andsalted keys—if compromised, stolen, or copied by an authorizedperson—cannot be used or replayed to access internal systems after acertain amount of time or after a certain event.

It may be understood that the blocks illustrated in FIG. 6 are notlimited to any specific order. One or more of the blocks may beperformed or executed simultaneously or near simultaneously. Forexample, the hashing and salting of the key may be performed at the sametime.

FIG. 7 illustrates an embodiment of an exemplary computing architecture700, e.g., of a computing device, such as a desktop computer, laptop,tablet computer, mobile computer, smartphone, etc., suitable forimplementing various embodiments as previously described. In oneembodiment, the computing architecture 700 may include or be implementedas part of a system, which will be further described below. As describedabove, at least one computing device and/or the processing circuitriesthereof may be configured to at least perform analysis on biologicalinformation associated with a user, determine biologicalcharacteristic(s) of the user, generate a unique character string basedon those characteristic(s), generate a biometric key via a cryptographicalgorithm, the output of which may be hashed, salted, and stored in oneor more storage devices, whereby the hash values, salt values, and/orhash function may be changed at various times.

As used in this application, the terms “system” and “component” areintended to refer to a computer-related entity, either hardware, acombination of hardware and software, software, or software inexecution, examples of which are provided by the exemplary computingarchitecture 700. For example, a component can be, but is not limited tobeing, a process running on a processor, a processor, a hard disk drive,multiple storage drives (of optical and/or magnetic storage medium), anobject, an executable, a thread of execution, a program, and/or acomputer. By way of illustration, both an application running on aserver and the server can be a component. One or more components canreside within a process and/or thread of execution, and a component canbe localized on one computer and/or distributed between two or morecomputers. Further, components may be communicatively coupled to eachother by various types of communications media to coordinate operations.The coordination may involve the uni-directional or bi-directionalexchange of information. For instance, the components may communicateinformation in the form of signals communicated over the communicationsmedia. The information can be implemented as signals allocated tovarious signal lines. In such allocations, each message is a signal.Further embodiments, however, may alternatively employ data messages.Such data messages may be sent across various connections. Exemplaryconnections include parallel interfaces, serial interfaces, and businterfaces.

The computing architecture 700 includes various common computingelements, such as one or more processors, multi-core processors,co-processors, memory units, chipsets, controllers, peripherals,interfaces, oscillators, timing devices, video cards, audio cards,multimedia input/output (I/O) components, power supplies, and so forth.The embodiments, however, are not limited to implementation by thecomputing architecture 700.

As shown in FIG. 7, the computing architecture 700 includes processor704, a system memory 706 and a system bus 708. The processor 704 can beany of various commercially available processors, processing circuitry,central processing unit (CPU), a dedicated processor, field-programmablegate array (FPGA), etc.

The system bus 708 provides an interface for system componentsincluding, but not limited to, the system memory 706 to the processor704. The system bus 708 can be any of several types of bus structurethat may further interconnect to a memory bus (with or without a memorycontroller), a peripheral bus, and a local bus using any of a variety ofcommercially available bus architectures. Interface adapters may connectto the system bus 708 via slot architecture. Example slot architecturesmay include without limitation Accelerated Graphics Port (AGP), CardBus, (Extended) Industry Standard Architecture ((E)ISA), Micro ChannelArchitecture (MCA), NuBus, Peripheral Component Interconnect (Extended)(PCI(X)), PCI Express, Personal Computer Memory Card InternationalAssociation (PCMCIA), and the like.

The computing architecture 700 may include or implement various articlesof manufacture. An article of manufacture may include acomputer-readable storage medium to store logic. Examples of acomputer-readable storage medium may include any tangible media capableof storing electronic data, including volatile memory or non-volatilememory, removable or non-removable memory, erasable or non-erasablememory, writeable or re-writeable memory, and so forth. Examples oflogic may include executable computer program instructions implementedusing any suitable type of code, such as source code, compiled code,interpreted code, executable code, static code, dynamic code,object-oriented code, visual code, and the like. Embodiments may also beat least partly implemented as instructions contained in or on anon-transitory computer-readable medium, which may be read and executedby one or more processors to enable performance of the operationsdescribed herein.

The system memory 706 may include various types of computer-readablestorage media in the form of one or more higher speed memory units, suchas read-only memory (ROM), random-access memory (RAM), dynamic RAM(DRAM), Double-Data-Rate DRAM (DDRAM), synchronous DRAM (SDRAM), staticRAM (SRAM), programmable ROM (PROM), erasable programmable ROM (EPROM),electrically erasable programmable ROM (EEPROM), flash memory, polymermemory such as ferroelectric polymer memory, ovonic memory, phase changeor ferroelectric memory, silicon-oxide-nitride-oxide-silicon (SONOS)memory, magnetic or optical cards, an array of devices such as RedundantArray of Independent Disks (RAID) drives, solid state memory devices(e.g., USB memory, solid state drives (SSD) and any other type ofstorage media suitable for storing information. In the illustratedembodiment shown in FIG. 7, the system memory 706 can includenon-volatile memory 710 and/or volatile memory 712. A basic input/outputsystem (BIOS) can be stored in the non-volatile memory 710.

The computer 702 may include various types of computer-readable storagemedia in the form of one or more lower speed memory units, including aninternal (or external) hard disk drive (HDD) 714, a magnetic floppy diskdrive (FDD) 716 to read from or write to a removable magnetic disk 718,and an optical disk drive 720 to read from or write to a removableoptical disk 722 (e.g., a CD-ROM or DVD). The HDD 714, FDD 716 andoptical disk drive 720 can be connected to the system bus 708 by a HDDinterface 724, an FDD interface 726 and an optical drive interface 728,respectively. The HDD interface 724 for external drive implementationscan include at least one or both of Universal Serial Bus (USB) and IEEE1394 interface technologies.

The drives and associated computer-readable media provide volatileand/or nonvolatile storage of data, data structures, computer-executableinstructions, and so forth. For example, a number of program modules canbe stored in the drives and memory units 710, 712, including anoperating system 730, one or more application programs 732, otherprogram modules 734, and program data 736. In one embodiment, the one ormore application programs 732, other program modules 734, and programdata 736 can include, for example, the various applications and/orcomponents of the system 800.

A user can enter commands and information into the computer 702 throughone or more wire/wireless input devices, for example, a keyboard 738 anda pointing device, such as a mouse 740. Other input devices may includemicrophones, infra-red (IR) remote controls, radio-frequency (RF) remotecontrols, game pads, stylus pens, card readers, dongles, finger printreaders, gloves, graphics tablets, joysticks, keyboards, retina readers,touch screens (e.g., capacitive, resistive, etc.), trackballs, trackpads, sensors, styluses, and the like. These and other input devices areoften connected to the processor 704 through an input device interface742 that is coupled to the system bus 708 but can be connected by otherinterfaces such as a parallel port, IEEE 1394 serial port, a game port,a USB port, an IR interface, and so forth.

A monitor 744 or other type of display device is also connected to thesystem bus 708 via an interface, such as a video adaptor 746. Themonitor 744 may be internal or external to the computer 702. In additionto the monitor 744, a computer typically includes other peripheraloutput devices, such as speakers, printers, and so forth.

The computer 702 may operate in a networked environment using logicalconnections via wire and/or wireless communications to one or moreremote computers, such as a remote computer 748. The remote computer 748can be a workstation, a server computer, a router, a personal computer,portable computer, microprocessor-based entertainment appliance, a peerdevice or other common network node, and typically includes many or allthe elements described relative to the computer 702, although, forpurposes of brevity, only a memory/storage device 750 is illustrated.The logical connections depicted include wire/wireless connectivity to alocal area network (LAN) 752 and/or larger networks, for example, a widearea network (WAN) 754. Such LAN and WAN networking environments arecommonplace in offices and companies, and facilitate enterprise-widecomputer networks, such as intranets, all of which may connect to aglobal communications network, for example, the Internet.

When used in a LAN networking environment, the computer 702 is connectedto the LAN 752 through a wire and/or wireless communication networkinterface or adaptor 756. The adaptor 756 can facilitate wire and/orwireless communications to the LAN 752, which may also include awireless access point disposed thereon for communicating with thewireless functionality of the adaptor 756.

When used in a WAN networking environment, the computer 702 can includea modem 758, or is connected to a communications server on the WAN 754or has other means for establishing communications over the WAN 754,such as by way of the Internet. The modem 758, which can be internal orexternal and a wire and/or wireless device, connects to the system bus708 via the input device interface 742. In a networked environment,program modules depicted relative to the computer 702, or portionsthereof, can be stored in the remote memory/storage device 750. It willbe appreciated that the network connections shown are exemplary andother means of establishing a communications link between the computerscan be used.

The computer 702 is operable to communicate with wire and wirelessdevices or entities using the IEEE 802 family of standards, such aswireless devices operatively disposed in wireless communication (e.g.,IEEE 802.11 over-the-air modulation techniques). This includes at leastWi-Fi (or Wireless Fidelity), WiMax, and Bluetooth™ wirelesstechnologies, among others. Thus, the communication can be a predefinedstructure as with a conventional network or simply an ad hoccommunication between at least two devices. Wi-Fi networks use radiotechnologies called IEEE 802.118 (a, b, g, n, etc.) to provide secure,reliable, fast wireless connectivity. A Wi-Fi network can be used toconnect computers to each other, to the Internet, and to wire networks(which use IEEE 802.3-related media and functions).

The various elements of the devices as previously described withreference to FIGS. 1-5 may include various hardware elements, softwareelements, or a combination of both. Examples of hardware elements mayinclude devices, logic devices, components, processors, microprocessors,circuits, processors, circuit elements (e.g., transistors, resistors,capacitors, inductors, and so forth), integrated circuits, applicationspecific integrated circuits (ASIC), programmable logic devices (PLD),digital signal processors (DSP), field programmable gate array (FPGA),memory units, logic gates, registers, semiconductor device, chips,microchips, chip sets, and so forth. Examples of software elements mayinclude software components, programs, applications, computer programs,application programs, system programs, software development programs,machine programs, operating system software, middleware, firmware,software modules, routines, subroutines, functions, methods, procedures,software interfaces, application program interfaces (API), instructionsets, computing code, computer code, code segments, computer codesegments, words, values, symbols, or any combination thereof. However,determining whether an embodiment is implemented using hardware elementsand/or software elements may vary in accordance with any number offactors, such as desired computational rate, power levels, heattolerances, processing cycle budget, input data rates, output datarates, memory resources, data bus speeds and other design or performanceconstraints, as desired for a given implementation.

FIG. 8 is a block diagram depicting an exemplary communicationsarchitecture 800 suitable for implementing various embodiments. Forexample, one or more computing devices may communicate with each othervia a communications framework, such as a network. At least onecomputing device connected to the network may be a client computingdevice, such as a desktop computer, laptop, tablet computer, smartphone,etc. The at least one computing device connected to the network may be aserver computer, which may be implemented as a back-end server. In someembodiments, the client computing device may be configured to generatethe character string that is unique to a user based on the user'sbiological information. The at least one back-end server computer, forinstance, may receive the character string and generate a uniquebiometric key, where the hashed and salted key(s) may be stored inserver data stores. This relates, for instance, to examples where thecharacter string may be generated by a third-party (e.g., a party thatdoes not control the back-end server computers).

The communications architecture 800 includes various commoncommunications elements, such as a transmitter, receiver, transceiver,radio, network interface, baseband processor, antenna, amplifiers,filters, power supplies, and so forth. The embodiments, however, are notlimited to implementation by the communications architecture 800.

As shown in FIG. 8, the communications architecture 800 includes one ormore clients 802 and servers 804. The one or more clients 802 and theservers 804 are operatively connected to one or more respective clientdata stores 806 and server data stores 807 that can be employed to storeinformation local to the respective clients 802 and servers 804, such ascookies and/or associated contextual information. By way of example,server data store 807 may store all hashed and salted biometric keys.

The clients 802 and the servers 804 may communicate information betweeneach other using a communication framework 810. The communicationsframework 810 may implement any well-known communications techniques andprotocols. The communications framework 810 may be implemented as apacket-switched network (e.g., public networks such as the Internet,private networks such as an enterprise intranet, and so forth), acircuit-switched network (e.g., the public switched telephone network),or a combination of a packet-switched network and a circuit-switchednetwork (with suitable gateways and translators).

The communications framework 810 may implement various networkinterfaces arranged to accept, communicate, and connect to acommunications network. A network interface may be regarded as aspecialized form of an input/output (I/O) interface. Network interfacesmay employ connection protocols including without limitation directconnect, Ethernet (e.g., thick, thin, twisted pair 10/100/1000 Base T,and the like), token ring, wireless network interfaces, cellular networkinterfaces, IEEE 802.7a-x network interfaces, IEEE 802.16 networkinterfaces, IEEE 802.20 network interfaces, and the like. Further,multiple network interfaces may be used to engage with variouscommunications network types. For example, multiple network interfacesmay be employed to allow for the communication over broadcast,multicast, and unicast networks. Should processing requirements dictatea greater amount speed and capacity, distributed network controllerarchitectures may similarly be employed to pool, load balance, andotherwise increase the communicative bandwidth required by clients 802and the servers 804. A communications network may be any one and thecombination of wired and/or wireless networks including withoutlimitation a direct interconnection, a secured custom connection, aprivate network (e.g., an enterprise intranet), a public network (e.g.,the Internet), a Personal Area Network (PAN), a Local Area Network(LAN), a Metropolitan Area Network (MAN), an Operating Missions as Nodeson the Internet (OMNI), a Wide Area Network (WAN), a wireless network, acellular network, and other communications networks.

The components and features of the devices described above may beimplemented using any combination of discrete circuitry, applicationspecific integrated circuits (ASICs), logic gates and/or single chiparchitectures. Further, the features of the devices may be implementedusing microcontrollers, programmable logic arrays and/or microprocessorsor any combination of the foregoing where suitably appropriate. It isnoted that hardware, firmware and/or software elements may becollectively or individually referred to herein as “logic” or “circuit.”

At least one computer-readable storage medium may include instructionsthat, when executed, cause a system to perform any of thecomputer-implemented methods described herein.

Some embodiments may be described using the expression “one embodiment”or “an embodiment” along with their derivatives. These terms mean that aparticular feature, structure, or characteristic described in connectionwith the embodiment is included in at least one embodiment. Theappearances of the phrase “in one embodiment” in various places in thespecification are not necessarily all referring to the same embodiment.Moreover, unless otherwise noted the features described above arerecognized to be usable together in any combination. Thus, any featuresdiscussed separately may be employed in combination with each otherunless it is noted that the features are incompatible with each other.

With general reference to notations and nomenclature used herein, thedetailed descriptions herein may be presented in terms of programprocedures executed on a computer or network of computers. Theseprocedural descriptions and representations are used by those skilled inthe art to most effectively convey the substance of their work to othersskilled in the art.

A procedure is here, and generally, conceived to be a self-consistentsequence of operations leading to a desired result. These operations arethose requiring physical manipulations of physical quantities. Usually,though not necessarily, these quantities take the form of electrical,magnetic or optical signals capable of being stored, transferred,combined, compared, and otherwise manipulated. It proves convenient attimes, principally for reasons of common usage, to refer to thesesignals as bits, values, elements, symbols, characters, terms, numbers,or the like. It should be noted, however, that all of these and similarterms are to be associated with the appropriate physical quantities andare merely convenient labels applied to those quantities.

Further, the manipulations performed are often referred to in terms,such as adding or comparing, which are commonly associated with mentaloperations performed by a human operator. No such capability of a humanoperator is necessary, or desirable in most cases, in any of theoperations described herein, which form part of one or more embodiments.Rather, the operations are machine operations.

Some embodiments may be described using the expression “coupled” and“connected” along with their derivatives. These terms are notnecessarily intended as synonyms for each other. For example, someembodiments may be described using the terms “connected” and/or“coupled” to indicate that two or more elements are in direct physicalor electrical contact with each other. The term “coupled,” however, mayalso mean that two or more elements are not in direct contact with eachother, but yet still co-operate or interact with each other.

Various embodiments also relate to apparatus or systems for performingthese operations. This apparatus may be specially constructed for therequired purpose and may be selectively activated or reconfigured by acomputer program stored in the computer. The procedures presented hereinare not inherently related to a particular computer or other apparatus.The required structure for a variety of these machines will appear fromthe description given.

It is emphasized that the Abstract of the Disclosure is provided toallow a reader to quickly ascertain the nature of the technicaldisclosure. It is submitted with the understanding that it will not beused to interpret or limit the scope or meaning of the claims. Inaddition, in the foregoing Detailed Description, it can be seen thatvarious features are grouped together in a single embodiment for thepurpose of streamlining the disclosure. This method of disclosure is notto be interpreted as reflecting an intention that the claimedembodiments require more features than are expressly recited in eachclaim. Rather, as the following claims reflect, inventive subject matterlies in less than all features of a single disclosed embodiment. Thus,the following claims are hereby incorporated into the DetailedDescription, with each claim standing on its own as a separateembodiment. In the appended claims, the terms “including” and “in which”are used as the plain-English equivalents of the respective terms“comprising” and “wherein,” respectively. Moreover, the terms “first,”“second,” “third,” and so forth, are used merely as labels, and are notintended to impose numerical requirements on their objects.

What has been described above includes examples of the disclosedarchitecture. It is, of course, not possible to describe everyconceivable combination of components and/or methodologies, but one ofordinary skill in the art may recognize that many further combinationsand permutations are possible. Accordingly, the novel architecture isintended to embrace all such alterations, modifications and variationsthat fall within the spirit and scope of the appended claims.

What is claimed is:
 1. A system comprising: at least a first computingdevice comprising: a first memory to store instructions; and firstprocessing circuitry, coupled with the first memory, operable to executethe instructions, that when executed, cause the first processingcircuitry to: receive biological information corresponding to a user viaat least one input device; perform analysis on the biologicalinformation; determine one or more biological characteristics uniquelyassociated with the user based on the performed analysis; generate acharacter string based at least in part on the one or more biologicalcharacteristics, wherein the character string comprises a plurality ofalphanumeric characters, the alphanumeric characters being spacedelimited and character delimited such that the space delimitation andthe character delimitation uniquely relates to the user; provide thecharacter string for generating a biometric key; at least a secondcomputing device comprising: a second memory to store instructions; andsecond processing circuitry, coupled with the second memory, operable toexecute the instructions, that when executed, cause the secondprocessing circuitry to: access or receive the character string;generate, using the character string, the biometric key based on acryptographic algorithm; apply at least one hash function to thebiometric key to generate a hashed biometric key; apply salt to thehashed biometric key to generate a salted and hashed biometric key;store the salted and hashed biometric key in one or more storagedevices; and change the applied at least one hash function at apredetermined interval in order to rotate, update, or roll the biometrickey.
 2. The system of claim 1, wherein the second processing circuitryis further caused to: (i) change the salt applied to the hashedbiometric key at the predetermined interval and/or (ii) change one ormore hash values of the at least one hash function at the predeterminedinterval.
 3. The system of claim 1, wherein the biological informationcomprises one or more of the following: (i) a fingerprint, (ii) a face,(iii) a palm print, (iv) palm veins, (v) a hand geometry, (vi) a voice,(vii) an iris, (viii) a retina, (ix) an eye scan.
 4. The system of claim1, wherein the at least one input device is one or more of thefollowing: (i) a camera, (ii) a microphone, (iii) a fingerprint reader,(iv) a palm print scanner or reader, (v) a palm vein scanner or reader,and (vii) an eye scanner.
 5. The system of claim 1, wherein theperformed analysis by the first processing circuitry comprisesdetermining one or more biological characteristics unique to the user.6. The system, of claim 5, wherein the one or more biologicalcharacteristics include one or more of the following: (i) a pupillarydistance (PD), (ii) a monocular PD, (iii) a distance between, ordistances among, an eye, a pupil, an ear, a nose, an upper lip, a lowerlip, and/or a chin, (iv) a face width, (v) a face height, (vi) voicefrequency, (vii) an arch, loop, and/or whorl of a fingerprint, (viii) adistance between at least two veins of a palm, (ix) a size of an iris,(x) a size of a pupil, and (xi) a distance between at least two veins ofa retina.
 7. The system of claim 1, wherein the biometric key is a512-bit key, a 768-bit key, a 1024-bit key, or a 2048-bit key.
 8. Thesystem of claim 1, wherein the cryptographic algorithm is one or more ofthe following: (i) a Triple Data Encryption Standard (DES) algorithm,(ii) a RSA public-key encryption algorithm, (iii) a Blowfish algorithm,(iv) a Twofish algorithm, (v) an Advanced Encryption Standard (AES)algorithm, (vi) a Diffie-Hellman algorithm, (vii) a Cramer-Shoupalgorithm, and (viii) a ElGamal encryption algorithm.
 9. The system ofclaim 1, wherein the at least one hash function is a one-waycryptographic hash function.
 10. The system of claim 1, wherein the saltis data uniquely associated with the user.
 11. A method comprising:generating, via at least a first computing device, a character stringbased at least in part on one or more biological characteristics of auser, wherein the character string comprises a plurality of alphanumericcharacters, the alphanumeric characters being space delimited andcharacter delimited such that the space delimitation and the characterdelimitation uniquely relates to the user; accessing or receiving, viaat least a second computing device, the character string from at leastthe first computing device; generating, via at least the secondcomputing device, using the character string, the biometric key based ona cryptographic algorithm; applying, via at least the second computingdevice, at least one hash function to the biometric key to generate ahashed biometric key; applying, via at least the second computingdevice, salt to the hashed biometric key to generate a salted and hashedbiometric key; and changing, via at least the second computing device,the applied at least one hash function at a predetermined interval inorder to rotate, update, or roll the biometric key.
 12. The method ofclaim 11, further comprising: receiving, via at least the firstcomputing device, biological information corresponding to the user viaat least one input device; performing, via at least the first computingdevice, analysis on the biological information; determining, via atleast the first computing device, the one or more biologicalcharacteristics uniquely associated with the user based on the performedanalysis; and providing, via at least the first computing device, thecharacter string for generating a biometric key to at least the secondcomputing device.
 13. The method of claim 12, further comprisingstoring, via at least the second computing device, the salted and hashedbiometric key in one or more storage devices.
 14. The method of claim12, wherein the biological information comprises one or more of thefollowing: (i) a fingerprint, (ii) a face, (iii) a palm print, (iv) palmveins, (v) a hand geometry, (vi) a voice, (vii) an iris, (viii) aretina, (ix) an eye scan.
 15. A non-transitory computer-readable storagemedium storing computer-readable program code executable by a processorto: access or receive a character string from at least a first computingdevice, wherein the character string comprises a plurality ofalphanumeric characters and is generated by the first computing devicebased at least in part on one or more biological characteristics of auser, the alphanumeric characters being space delimited and characterdelimited such that the space delimitation and the characterdelimitation uniquely relates to the user; generate, using the characterstring, a biometric key based on a cryptographic algorithm; apply atleast one hash function to the biometric key to generate a hashedbiometric key; apply salt to the hashed biometric key to generate asalted and hashed biometric key; and change the applied at least onehash function at a predetermined interval in order to rotate, update, orroll the biometric key.
 16. The non-transitory computer-readable storagemedium of claim 15, wherein the processor executing thecomputer-readable program code is included in at least a secondcomputing device separate from at least the first computing device. 17.The non-transitory computer-readable storage medium of claim 15, whereinthe cryptographic algorithm is one or more of the following: (i) aTriple Data Encryption Standard (DES) algorithm, (ii) a RSA public-keyencryption algorithm, (iii) a Blowfish algorithm, (iv) a Twofishalgorithm, (v) an Advanced Encryption Standard (AES) algorithm, (vi) aDiffie-Hellman algorithm, (vii) a Cramer-Shoup algorithm, and (viii) aElGamal encryption algorithm.
 18. The non-transitory computer-readablestorage medium of claim 15, wherein the at least one hash function is aone-way cryptographic hash function.